Some RolesAsk First

A role carries its own connected apps, workflows and datasets, which makes it the thing that decides whose data moves where. A clinic role reaches a patient database. A sales role reads a mailbox and sends to leads. So the agreement belongs to the role, not buried in a settings page nobody opens, and the role will not switch on until the current version of it has been accepted.

• The author of the role writes the agreement and declares its version
• The person reads it in the app at the moment they try to use the role
• Accepting is what activates the role. Declining leaves it off
• A role that declares nothing behaves exactly as before

What gets stored is not "accepted, version 2". It is a fingerprint of the exact document that appeared on the screen, next to the version number the author claimed. Those two together answer the question a version number alone cannot: an author who edits the terms in place without bumping the version would otherwise keep every earlier acceptance looking valid.

• The version the author declared, and a fingerprint of the text itself
• The moment it was accepted, in UTC
• The signed-in account, when there was one. Someone signed out can still accept
• Editing the text without changing the version invalidates the old acceptance rather than inheriting it

Nothing overwrites an acceptance. A newer version adds a row, it does not replace the old one, because superseding it would destroy the only question the record exists to answer: what did this person agree to, and when.

• One row per acceptance, kept as it was written
• A new version adds to the history rather than replacing it
• The file lives on your own machine, in your Plexon folder
• Nothing is uploaded for this. It is a local record

A missing record file, a document that cannot be read, a role that names an agreement nothing can resolve: all of them refuse to activate the role. That is the awkward direction and it is the deliberate one. Failing the other way turns an authoring mistake into a role that silently reaches sensitive data with nobody having agreed to anything, which is the single outcome the whole mechanism exists to prevent.

• Any uncertainty refuses activation instead of allowing it
• Installing several roles at once gates every one of them, not just the one you picked
• That matters because a merged profile holds the union of what those roles reach
• You get told which role is asking, and for what